Skip to main content
BackPrunes Roomie

Cookie policy

How Prunes Roomie uses cookies and similar technologies, and how you control them — in real time.

Your current choices

Strictly necessary
Authentication, security, load balancing, CSRF, language preference and this consent record. Exempt under ePrivacy Art. 5(3) and analogous laws.
Analytics
Aggregated usage measurement to fix bugs and improve performance. Opt-in only. Cleared when withdrawn.
Marketing
Campaign measurement and personalization. Opt-in only. Withdrawal is as easy as consent.

Changes take effect immediately across the site and are broadcast via the pr:consent-change event. You can reopen the banner at any time from the Cookies chip in the bottom-left corner.

1. What cookies and similar technologies are

A "cookie" is a small text file placed on your device by the site you visit. "Similar technologies" include local storage, IndexedDB, pixels, SDK identifiers, and server-side fingerprinting signals. In this policy, "cookies" covers all of them, as contemplated by EDPB Guidelines 2/2023 on tracking technologies beyond HTTP cookies and by the ICO's 2023 cookies guidance.

2. Categories we use

  • Strictly necessary — sign-in session, CSRF protection, load-balancer routing, language preference, and this consent record itself. Legal basis: ePrivacy Art. 5(3) exemption and GDPR Art. 6(1)(b)/(f); CCPA §1798.140(e) "necessary service" carve-out.
  • Analytics (opt-in) — aggregated usage stats to detect performance regressions. Legal basis: GDPR Art. 6(1)(a) consent; UK PECR reg. 6 consent; CCPA opt-out preserved via Global Privacy Control (Cal. Code Regs. tit. 11 §7025).
  • Marketing (opt-in) — campaign attribution and personalization. Legal basis: GDPR Art. 6(1)(a); ePrivacy Art. 5(3); LGPD Art. 7(I); PDPA §13; APP 7.
  • Machine translation (only when you ask for it) — if you choose a language we do not ship an in-app translation pack for, we load the Google Website Translator, which sets a googtrans cookie and receives your IP address and the page URL so it can return the translated text. This does not run for English, and it does not run before you pick a language: no request reaches Google until you do. Legal basis: the ePrivacy Art. 5(3) "strictly necessary to provide a service explicitly requested by the subscriber or user" exemption, together with GDPR Art. 6(1)(b). Selecting English again removes the cookie.

3. Legal bases across jurisdictions

Our default is prior, freely-given, specific, informed and unambiguous consent (GDPR Art. 4(11); EDPB Guidelines 05/2020). Where you interact from the US, we treat analytics and marketing categories as opt-out under CCPA/CPRA and honor Global Privacy Control signals. Where you interact from Brazil, Canada, South Africa, Singapore, India or Australia, we apply the equivalent local rule (LGPD Art. 8; PIPEDA "meaningful consent"; POPIA §11(1)(b); PDPA §14; DPDPA §6; APP 3).

4. Third parties

Third-party cookies are only set after you consent to the matching category. Sub-processors are listed with their purpose, transfer safeguard (SCCs, IDTA, adequacy decision, or LGPD Art. 33) and retention in our data-transfer log. We do not "sell" or "share for cross-context behavioral advertising" as defined by CCPA §1798.140(ad)–(ah).

Embedded content (click-to-load). Some pages can show content hosted elsewhere — 3D apartment tours and training videos. Loading an embed sends your IP address, browser details and the page address to that provider, so we do not load one automatically. Until you either accept the marketing category or press the load button on that specific embed, you see a placeholder instead of the provider's player. This is the same standard ePrivacy Art. 5(3) applies to cookies: no non-essential third-party access to your device without a prior, specific, informed action by you. You can always open the content in a new tab instead, which keeps the transfer off this page.

5. Retention

Strictly necessary cookies persist only for the session or up to 365 days for language and consent state. Analytics and marketing cookies are deleted the moment you withdraw consent — including from local storage — and are re-created only after fresh consent. Server-side telemetry is retained under our published retention schedule and DSAR playbook.

6. Your rights

  • Access, rectification, erasure, portability, restriction, objection (GDPR Arts. 15–22).
  • Right to know, delete, correct, opt-out of sale/sharing, limit sensitive PI (CCPA/CPRA §§1798.100–1798.135).
  • Right to withdraw consent as easily as it was given (GDPR Art. 7(3); LGPD Art. 8§5).
  • Right to lodge a complaint with your supervisory authority.

Submit a request through your account's Privacy → Data Request panel or email privacy@prunesroomie.com.

7. Do Not Track and Global Privacy Control

We honor GPC signals as an opt-out of sale/sharing under CPRA and equivalent US state laws (Colorado CPA, Connecticut CTDPA, Virginia VCDPA, Utah UCPA, Texas TDPSA). Legacy DNT is respected but is not treated as a legal opt-out by itself.

8. Changes to this policy

The live-choice panel above always reflects your current consent. Substantive updates to categories, retention, or sub-processors re-open the banner so you can re-consent. A revision log is kept in our public Legal Library.

9. Contact

Data Protection Officer: dpo@prunesroomie.com. EU/UK representative and full sub-processor list are published in the Privacy Policy.

Peer-reviewed and regulator-authored sources consulted: EDPB Guidelines 05/2020 and 2/2023; ICO cookies guidance (2023); CPPA regulations (Cal. Code Regs. tit. 11 §§7000–7304); ANPD Guia de cookies (2022); OPC "Guidelines for online consent" (2014/2021); OAIC APP guidelines (2019); Utz et al., ACM CCS 2019; Nouwens et al., ACM CHI 2020; Kretschmer & Pernul, Computers & Security 2021.